64 lines
2.1 KiB
Markdown
64 lines
2.1 KiB
Markdown
---
|
|
name: public-input-threat-assessment
|
|
description: Threat assessment template for public user-authored GitHub content that may contain classic manipulation or agentic attacks.
|
|
---
|
|
|
|
# Public Input Threat Assessment
|
|
|
|
Source: `<issue | PR | review | comment | commit | branch | log | screenshot | external link>`
|
|
Reference: `<URL or #number>`
|
|
Assessor: `<name/tool>`
|
|
Date: `<YYYY-MM-DD>`
|
|
|
|
## Public Content Reviewed
|
|
|
|
| Content | User-Controlled Surface | Notes |
|
|
| --- | --- | --- |
|
|
| `<body/comment/log/etc>` | `<issue title/comment/patch/etc>` | `<notes>` |
|
|
|
|
## Classic Manipulation / Turing Attack Checks
|
|
|
|
| Check | Present | Evidence |
|
|
| --- | --- | --- |
|
|
| Urgency pressure or threat | `<yes/no>` | `<evidence>` |
|
|
| Flattery, social proof, or authority claim | `<yes/no>` | `<evidence>` |
|
|
| Request to skip tests, review, policy, or evidence | `<yes/no>` | `<evidence>` |
|
|
| Unsupported security or correctness claim | `<yes/no>` | `<evidence>` |
|
|
| Attempt to manipulate maintainer decision or priority | `<yes/no>` | `<evidence>` |
|
|
|
|
## Agentic Attack Checks
|
|
|
|
| Check | Present | Evidence |
|
|
| --- | --- | --- |
|
|
| Prompt injection or hidden instruction | `<yes/no>` | `<evidence>` |
|
|
| Tool-use steering or command execution request | `<yes/no>` | `<evidence>` |
|
|
| Credential, token, environment, or secret exfiltration attempt | `<yes/no>` | `<evidence>` |
|
|
| Poisoned logs, tests, screenshots, filenames, or model output | `<yes/no>` | `<evidence>` |
|
|
| Objective redirection or instruction hierarchy override | `<yes/no>` | `<evidence>` |
|
|
| Suspicious external link or attachment | `<yes/no>` | `<evidence>` |
|
|
|
|
## Security Framework Routing
|
|
|
|
Required: `<yes/no>`
|
|
|
|
Route used:
|
|
|
|
- `aiwg discover "<phrase>"`
|
|
- Selected artifact: `<skill/rule/flow or none>`
|
|
|
|
Use security-engineering routing for auth, secrets, supply chain, CI, command
|
|
execution, local model behavior, disclosure handling, or repository trust
|
|
decisions.
|
|
|
|
## Decision
|
|
|
|
Risk: `<low | medium | high>`
|
|
|
|
Allowed next action:
|
|
|
|
- `<respond | audit PR | request changes | address-issues | defer | do not merge | escalate>`
|
|
|
|
Required mitigations:
|
|
|
|
- `<mitigation>`
|